Nftables monitor disable

[cheina97]

Description

This PR introduces a flag to disable the nftables monitoring routine in liqo-fabric.
This is useful because the monitoring routine uses many resources in some cases (like k3s).
It also disables by default the routine in liqoctl k3s provider.

[cheina97]

/rebase test=true

[adamjensenbot]

Hi @cheina97. Thanks for your PR!

I am @adamjensenbot.
You can interact with me issuing a slash command in the first line of a comment.
Currently, I understand the following commands:

• /rebase: Rebase this PR onto the master branch (You can add the option test=true to launch the tests
  when the rebase operation is completed)
• /merge: Merge this PR into the master branch
• /build Build Liqo components
• /test Launch the E2E and Unit tests
• /hold, /unhold Add/remove the hold label to prevent merging with /merge

Make sure this PR appears in the liqo changelog, adding one of the following labels:

• kind/breaking: 💥 Breaking Change
• kind/feature: 🚀 New Feature
• kind/bug: 🐛 Bug Fix
• kind/cleanup: 🧹 Code Refactoring
• kind/docs: 📝 Documentation

[cheina97]

/build

[cheina97]

/rebase test=true

[cheina97]

/rebase test=true

[cheina97]

/rebase test=true

[cheina97]

/rebase test=true

[fra98]

/merge

[frisso]

@cheina97 Thanks for this fix, I was encountering exactly this issue (i.e., the 'liqo-fabric' pod constantly consuming one full CPU core).
However, it is not clear to me what this fix leaves behind. Which feature do I loose when this flag is turned off?

[cheina97]

@cheina97 Thanks for this fix, I was encountering exactly this issue (i.e., the 'liqo-fabric' pod constantly consuming one full CPU core). However, it is not clear to me what this fix leaves behind. Which feature do I lose when this flag is turned off?

Hi @frisso

If you disable this feature if someone or something deletes liqo's firewall rules on the nodes they are not restored until a reconcile is triggered (changing a firewallconfiguration resource or waiting for the periodic forced reconcile, which is by default 10 hours) or the liqo-fabric pods restart.

This is just an extra layer of protection against "who" should remove our nftables rules from the host (note that this feature still works in gateways).